LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 06-20-2011, 07:15 AM   #1
xombboxer
Member
 
Registered: Apr 2011
Posts: 63

Rep: Reputation: 0
How find out PID of a command which is in history


If someone has done something wrong on a shared linux machine. If i want to find out who is that person or ip from where it is been done what are all the possible ways..

1 possibility I thought was to get the PID of the command and get other details from that PID?
 
Old 06-20-2011, 07:32 AM   #2
Reuti
Senior Member
 
Registered: Dec 2004
Location: Marburg, Germany
Distribution: openSUSE 13.1
Posts: 1,328

Rep: Reputation: 254Reputation: 254Reputation: 254
You mean by "shared machine" also a "shared user account"?
 
Old 06-20-2011, 06:59 PM   #3
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.9, Centos 7.3
Posts: 17,395

Rep: Reputation: 2395Reputation: 2395Reputation: 2395Reputation: 2395Reputation: 2395Reputation: 2395Reputation: 2395Reputation: 2395Reputation: 2395Reputation: 2395Reputation: 2395
If the cmd is no longer running, you won't have the PID; it's not (normally) stored in the HISTORY file, although you may be able to set that.
You prob want to start with the log files (/var/log/*), looking for entries around the time you think something happened.
If you have a specific qn in mind, please tell us for better directions.
 
Old 06-21-2011, 02:05 AM   #4
ssrameez
Member
 
Registered: Oct 2006
Location: bangalore
Distribution: Fedora, Ubuntu, Debian, Redhat
Posts: 82

Rep: Reputation: 6
/var/log/messages and other log files in /var/log will provide an insight into what has happened in your system. Who has logged in. How a user logged in .. etc.

If you want to capture the PIDs then, you might need to write a script and log it. But that is not a nice idea to go ahead while considering performance and space constraints.
 
Old 06-21-2011, 02:09 AM   #5
ssrameez
Member
 
Registered: Oct 2006
Location: bangalore
Distribution: Fedora, Ubuntu, Debian, Redhat
Posts: 82

Rep: Reputation: 6
Also there is a software called PowerBroker. But it is not freeware.

Check the link http://www.linuxforums.org/forum/sec...ternative.html

--Rameez
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Print all PID folders from /proc line-by-line with this format (( PID: command-line )) courteous Linux - Newbie 7 12-12-2010 04:47 PM
[SOLVED] Is there any command to delete bash command history? cola Linux - Newbie 4 06-01-2010 07:32 AM
URGENT! Is there any command to get a history command lines and time in SUSE Linux.? igsoper Linux - Software 5 06-25-2009 02:14 AM
Find PID of /bin/sh command in C++ Curtor Programming 3 12-11-2008 09:04 AM
how to find all files with pid Zac2003 Linux - Software 2 10-27-2004 09:44 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 11:42 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration